@opendatalabs/vana-sdk 4.4.0 → 4.5.0

package/dist/connect/protocol.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/connect/protocol.ts"],"sourcesContent":["/**\n * Message protocol for the Vana connect sheet, shared by the partner-side\n * launcher and the Vana-hosted sheet.\n *\n * @remarks\n * Zero-dependency and browser-safe: it imports nothing, so a non-SDK\n * consumer (Vana Account's sheet, a backend validating a request) can take\n * it alone from `@opendatalabs/vana-sdk/connect/protocol`.\n *\n * ```\n *   partner page                                   Vana sheet (iframe)\n *   ────────────                                   ───────────────────\n *   GET clientCheckUrl(...)             ───────▶   Vana's server: { registered }\n *                                                  (alongside framing; false ends it\n *                                                  with origin_not_registered)\n *   iframe src = sheetUrl(...)          ───────▶   renders, bound to partner origin,\n *                                                  laid out for its `display`\n *                                       ◀───────   vana:ready\n *                                       ◀───────   vana:resize { height }\n *                                       ◀───────   vana:signed-in\n *                                       ◀───────   vana:request-needed\n *   vana:request { request }            ───────▶   loads the request via Vana's server\n *                                       ◀───────   vana:connected { status, completion }\n *                                                  (approved; data follows in the sheet)\n *                                       ◀───────   vana:progress { phase }\n *                                                  (remote_collect only; coarse, no source detail)\n *   vana:request-status { status }      ───────▶   shows the partner-observed outcome\n *                                       ◀───────   vana:close | vana:error { code }\n * ```\n *\n * Every message carries `v`. Both sides post with an exact `targetOrigin` and\n * check `event.origin` and `event.source` before parsing. Tokens never cross\n * this boundary: the sheet only reports outcomes.\n *\n * The partner reads; it never writes. Approving a read request grants no\n * write access, so there is no partner-to-sheet message that saves data.\n *\n * `vana:connected` means the person approved. It is not delivery: the data\n * is ready only once the partner's backend reads it (the status poll and the\n * read of the Direct flow say so).\n *\n * Versioning: the sheet URL carries the highest version the launcher speaks\n * (`v`). Parsers accept any version from {@link MIN_PROTOCOL_VERSION} to\n * {@link PROTOCOL_VERSION} and drop fields they do not know, so a sheet may\n * add fields without a version bump. A `vana:ready` or `vana:error` at a\n * version outside that range is reported as `incompatible_version` (see\n * {@link readIncompatibleVersion}).\n *\n * @category Connect\n * @module connect/protocol\n */\n\n/** The protocol version this SDK posts and puts in the sheet URL. */\nexport const PROTOCOL_VERSION = 1;\n\n/** The oldest protocol version this SDK still accepts from the other side. */\nexport const MIN_PROTOCOL_VERSION = 1;\n\n/** A protocol version this SDK accepts. */\nexport type ProtocolVersion = typeof PROTOCOL_VERSION;\n\n/** Path of the sheet page on the Vana Account origin. */\nexport const SHEET_PATH = \"/embed/connect\";\n\n/**\n * Says whether a (client id, partner origin) pair may frame the sheet.\n *\n * @remarks\n * The browser refuses an unregistered frame silently, so the launcher asks\n * here (without credentials) to name that failure instead of waiting out\n * `frame_blocked`.\n */\nexport const CLIENT_CHECK_PATH = \"/api/embed/connect/client\";\n\n/** Query parameters the sheet reads. The origin is re-checked server side. */\nexport const SHEET_QUERY = {\n  clientId: \"client_id\",\n  display: \"display\",\n  origin: \"origin\",\n  version: \"v\",\n} as const;\n\n/**\n * How the sheet is presented in the partner's window:\n * `sheet`  a bottom sheet over the page, sized to its content;\n * `fullscreen`  fills the whole window, for a window that holds nothing else,\n *               such as a small popup the partner opened.\n * It is presentation only: it authorizes nothing and the sheet's steps,\n * messages and events are the same in both.\n */\nexport const CONNECT_DISPLAYS = [\"sheet\", \"fullscreen\"] as const;\n\n/** One of {@link CONNECT_DISPLAYS}. */\nexport type ConnectDisplay = (typeof CONNECT_DISPLAYS)[number];\n\n/** The display `connect.open` uses when none is asked for. */\nexport const DEFAULT_CONNECT_DISPLAY: ConnectDisplay = \"sheet\";\n\n/**\n * Read a display from untrusted input.\n *\n * @param value - Anything.\n * @returns A known display, or `null` for anything else.\n */\nexport function readConnectDisplay(value: unknown): ConnectDisplay | null {\n  return CONNECT_DISPLAYS.find((known) => known === value) ?? null;\n}\n\n/** Vana Account origin per deployment environment. */\nexport const VANA_ACCOUNT_ORIGINS = {\n  production: \"https://account.vana.org\",\n  dev: \"https://account-dev.vana.org\",\n} as const;\n\n/** Environment names {@link VANA_ACCOUNT_ORIGINS} is keyed by. */\nexport type VanaConnectEnv = keyof typeof VANA_ACCOUNT_ORIGINS;\n\n/**\n * The production Vana Account origin.\n *\n * @remarks\n * Never used as an implicit default: the launcher, the flow and the CSP\n * helper all need an explicit environment or origin, so a dev app cannot\n * silently talk to production. Resolve the origin with\n * `resolveVanaAccountOrigin` instead.\n */\nexport const DEFAULT_VANA_ORIGIN = VANA_ACCOUNT_ORIGINS.production;\n\n/**\n * How an approved request gets its data, always inside this sheet.\n *\n * @remarks\n * `in_browser`: the person's Personal Server already holds every scope and\n * serves them from the sheet until the partner reads.\n * `remote_collect`: some scopes are missing, so the sheet collects them (a\n * remote browser, driven with the person) and then serves.\n */\nexport type ConnectCompletion = \"in_browser\" | \"remote_collect\";\n\nconst CONNECT_COMPLETIONS: readonly ConnectCompletion[] = [\n  \"in_browser\",\n  \"remote_collect\",\n];\n\n/**\n * Where a `remote_collect` request stands once approved. Deliberately coarse:\n * it says nothing of which source, what was asked of the person, or how it is\n * going. The partner shows \"Vana is collecting your data\", nothing more.\n */\nexport type ConnectProgressPhase = \"collecting\" | \"writing\";\n\nconst PROGRESS_PHASES: readonly ConnectProgressPhase[] = [\n  \"collecting\",\n  \"writing\",\n];\n\n/** Height reports below this are a hidden or throttled frame, never content. */\nexport const MIN_SHEET_HEIGHT_PX = 80;\n\n/** Direct Data Controller status vocabulary, as the partner backend sees it. */\nexport type RequestStatus =\n  | \"pending\"\n  | \"approved\"\n  | \"completed\"\n  | \"denied\"\n  | \"expired\";\n\n/**\n * A partner-signed, short-lived read capability for one request.\n *\n * @remarks\n * The sheet asks for it (`vana:request-needed`) once the person has signed\n * in, so the partner signs it fresh; it expires within minutes. It is the\n * Direct SDK request signature for `GET /api/data-connection-requests/<id>`,\n * minted by the partner's backend with its app key. Vana's server replays it\n * to the request authority, so the sheet shows the request's real scopes and\n * the partner cannot claim someone else's app.\n */\nexport interface RequestAuthorization {\n  appAddress: `0x${string}`;\n  signature: `0x${string}`;\n  timestamp: string;\n}\n\n/** What the partner hands the sheet: a request id and its read capability. */\nexport interface ConnectRequest {\n  authorization: RequestAuthorization;\n  id: string;\n}\n\n/**\n * Error codes the sheet reports.\n *\n * @remarks\n * `frame_blocked`: no `vana:ready` in time, usually the page's own CSP.\n * `incompatible_version`: the sheet speaks a protocol version this SDK does\n * not (detected by the launcher).\n * `origin_not_registered`: this page's origin is not registered for the\n * client id.\n * `vana_unavailable`: Vana itself is misconfigured or down here. Nothing the\n * partner did, and nothing the partner can fix; the sheet stays open to say\n * so.\n * `sheet_failed`: the sheet could not finish this request.\n */\nexport type SheetErrorCode =\n  | \"frame_blocked\"\n  | \"incompatible_version\"\n  | \"origin_not_registered\"\n  | \"personal_server_unsupported\"\n  | \"request_unavailable\"\n  | \"sheet_failed\"\n  | \"vana_unavailable\";\n\n/** Sheet to partner. */\nexport type SheetMessage =\n  | { type: \"vana:ready\"; v: ProtocolVersion }\n  | { height: number; type: \"vana:resize\"; v: ProtocolVersion }\n  | { type: \"vana:signed-in\"; v: ProtocolVersion }\n  | { type: \"vana:request-needed\"; v: ProtocolVersion }\n  | {\n      completion: ConnectCompletion;\n      status: \"approved\";\n      type: \"vana:connected\";\n      v: ProtocolVersion;\n    }\n  | {\n      phase: ConnectProgressPhase;\n      type: \"vana:progress\";\n      v: ProtocolVersion;\n    }\n  | { type: \"vana:close\"; v: ProtocolVersion }\n  | { code: SheetErrorCode; type: \"vana:error\"; v: ProtocolVersion };\n\n/** Partner to sheet. */\nexport type PartnerMessage =\n  | {\n      request: ConnectRequest;\n      type: \"vana:request\";\n      v: ProtocolVersion;\n    }\n  | {\n      status: RequestStatus;\n      type: \"vana:request-status\";\n      v: ProtocolVersion;\n    };\n\nconst REQUEST_STATUSES: readonly RequestStatus[] = [\n  \"pending\",\n  \"approved\",\n  \"completed\",\n  \"denied\",\n  \"expired\",\n];\n\nconst SHEET_ERROR_CODES: readonly SheetErrorCode[] = [\n  \"frame_blocked\",\n  \"incompatible_version\",\n  \"origin_not_registered\",\n  \"personal_server_unsupported\",\n  \"request_unavailable\",\n  \"sheet_failed\",\n  \"vana_unavailable\",\n];\n\nconst HEX_ADDRESS = /^0x[0-9a-fA-F]{40}$/;\nconst HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;\nconst REQUEST_ID = /^[A-Za-z0-9_-]{1,128}$/;\nconst TIMESTAMP = /^[0-9]{10,16}$/;\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction isSupportedVersion(value: unknown): value is ProtocolVersion {\n  return (\n    typeof value === \"number\" &&\n    Number.isInteger(value) &&\n    value >= MIN_PROTOCOL_VERSION &&\n    value <= PROTOCOL_VERSION\n  );\n}\n\n/**\n * Whether a request id has the shape the sheet accepts.\n *\n * @remarks\n * The id is signed into a request path, so anything outside this shape could\n * name a different resource. Signers refuse it.\n *\n * @param value - The candidate request id.\n * @returns `true` for 1 to 128 characters of `[A-Za-z0-9_-]`.\n */\nexport function isRequestId(value: unknown): value is string {\n  return typeof value === \"string\" && REQUEST_ID.test(value);\n}\n\nfunction readAuthorization(value: unknown): RequestAuthorization | null {\n  const auth = record(value);\n  if (!auth) {\n    return null;\n  }\n  const { appAddress, signature, timestamp } = auth;\n  if (\n    typeof appAddress !== \"string\" ||\n    !HEX_ADDRESS.test(appAddress) ||\n    typeof signature !== \"string\" ||\n    !HEX_SIGNATURE.test(signature) ||\n    typeof timestamp !== \"string\" ||\n    !TIMESTAMP.test(timestamp)\n  ) {\n    return null;\n  }\n  return {\n    appAddress: appAddress as `0x${string}`,\n    signature: signature as `0x${string}`,\n    timestamp,\n  };\n}\n\n/**\n * Parse a {@link ConnectRequest}. Extra fields are dropped.\n *\n * @param value - Untrusted input.\n * @returns The request, or `null` when malformed.\n */\nexport function readConnectRequest(value: unknown): ConnectRequest | null {\n  const request = record(value);\n  if (!request || !isRequestId(request.id)) {\n    return null;\n  }\n  const authorization = readAuthorization(request.authorization);\n  return authorization ? { authorization, id: request.id } : null;\n}\n\n/**\n * Detect a sheet that speaks a protocol version this SDK does not.\n *\n * @remarks\n * Only `vana:ready` and `vana:error` are read at any version: they are the\n * handshake, so the launcher can tell \"the sheet is up but incompatible\" from\n * \"the sheet never started\". Everything else at an unknown version is ignored.\n *\n * @param data - A message posted by the sheet.\n * @returns The sheet's version when it is outside the supported range,\n * otherwise `null`.\n */\nexport function readIncompatibleVersion(data: unknown): number | null {\n  const message = record(data);\n  if (\n    !message ||\n    (message.type !== \"vana:ready\" && message.type !== \"vana:error\")\n  ) {\n    return null;\n  }\n  const { v } = message;\n  if (typeof v !== \"number\" || !Number.isInteger(v) || isSupportedVersion(v)) {\n    return null;\n  }\n  return v;\n}\n\n/**\n * Parse a message the sheet posted.\n *\n * @remarks\n * Unknown fields are dropped. Unknown message types are ignored. An error\n * code this SDK does not know is read as `sheet_failed`, so a newer sheet's\n * failure is never silently lost.\n *\n * @param data - Untrusted `MessageEvent.data`.\n * @returns The message, or `null` for unknown or malformed data.\n */\nexport function parseSheetMessage(data: unknown): SheetMessage | null {\n  const message = record(data);\n  if (!(message && isSupportedVersion(message.v))) {\n    return null;\n  }\n  const v = message.v;\n  switch (message.type) {\n    case \"vana:ready\":\n    case \"vana:signed-in\":\n    case \"vana:request-needed\":\n    case \"vana:close\":\n      return { type: message.type, v };\n    case \"vana:resize\": {\n      const { height } = message;\n      if (typeof height !== \"number\" || !Number.isFinite(height)) {\n        return null;\n      }\n      return { height, type: \"vana:resize\", v };\n    }\n    case \"vana:connected\": {\n      const completion = CONNECT_COMPLETIONS.find(\n        (known) => known === message.completion,\n      );\n      return message.status === \"approved\" && completion\n        ? { completion, status: \"approved\", type: \"vana:connected\", v }\n        : null;\n    }\n    case \"vana:progress\": {\n      const phase = PROGRESS_PHASES.find((known) => known === message.phase);\n      return phase ? { phase, type: \"vana:progress\", v } : null;\n    }\n    case \"vana:error\": {\n      if (typeof message.code !== \"string\") {\n        return null;\n      }\n      const code =\n        SHEET_ERROR_CODES.find((known) => known === message.code) ??\n        \"sheet_failed\";\n      return { code, type: \"vana:error\", v };\n    }\n    default:\n      return null;\n  }\n}\n\n/**\n * Parse a message the partner posted.\n *\n * @param data - Untrusted `MessageEvent.data`.\n * @returns The message, or `null` for unknown or malformed data.\n */\nexport function parsePartnerMessage(data: unknown): PartnerMessage | null {\n  const message = record(data);\n  if (!(message && isSupportedVersion(message.v))) {\n    return null;\n  }\n  const v = message.v;\n  switch (message.type) {\n    case \"vana:request\": {\n      const request = readConnectRequest(message.request);\n      return request ? { request, type: \"vana:request\", v } : null;\n    }\n    case \"vana:request-status\": {\n      const status = REQUEST_STATUSES.find((known) => known === message.status);\n      return status ? { status, type: \"vana:request-status\", v } : null;\n    }\n    default:\n      return null;\n  }\n}\n\n/**\n * Normalize to a bare origin.\n *\n * @param value - A URL or origin.\n * @returns `scheme://host[:port]` for http(s), or `null` for anything else.\n */\nexport function normalizeOrigin(value: string): string | null {\n  try {\n    const url = new URL(value);\n    if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n      return null;\n    }\n    return url.origin;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Build the client-check URL the launcher asks before the sheet is ready.\n *\n * @param input - The registered client id, the partner page origin, and the\n * Vana Account origin.\n * @returns `<vanaOrigin>/api/embed/connect/client?client_id&origin`.\n */\nexport function clientCheckUrl(input: {\n  clientId: string;\n  partnerOrigin: string;\n  vanaOrigin: string;\n}): string {\n  const url = new URL(CLIENT_CHECK_PATH, input.vanaOrigin);\n  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);\n  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);\n  return url.toString();\n}\n\n/**\n * Parse the client-check response body.\n *\n * @param data - Untrusted JSON.\n * @returns `{ registered }`, or `null` for anything else.\n */\nexport function parseClientCheck(\n  data: unknown,\n): { registered: boolean } | null {\n  const body = record(data);\n  return body && typeof body.registered === \"boolean\"\n    ? { registered: body.registered }\n    : null;\n}\n\n/**\n * Build the sheet's iframe URL.\n *\n * @param input - The registered client id, the partner page origin, the Vana\n * Account origin, and optionally the display.\n * @returns `<vanaOrigin>/embed/connect?client_id&origin&v`, plus `display` when\n * it is not the default.\n */\nexport function sheetUrl(input: {\n  clientId: string;\n  display?: ConnectDisplay;\n  partnerOrigin: string;\n  vanaOrigin: string;\n}): string {\n  const url = new URL(SHEET_PATH, input.vanaOrigin);\n  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);\n  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);\n  url.searchParams.set(SHEET_QUERY.version, String(PROTOCOL_VERSION));\n  // The default is left out: a bottom sheet's URL is what it has always been.\n  if (input.display && input.display !== DEFAULT_CONNECT_DISPLAY) {\n    url.searchParams.set(SHEET_QUERY.display, input.display);\n  }\n  return url.toString();\n}\n\n/**\n * Content-Security-Policy sources a partner page needs for the sheet.\n *\n * @remarks\n * The launcher is bundled into the partner's own code, so only the frame\n * and the launcher's client check (a credential-less `fetch`) need\n * allowing. Merge the result into your existing policy; if the page sets\n * `child-src` but not `frame-src`, add the origin there instead. There is no\n * default target, so a dev app never allows production by accident.\n *\n * @example\n * ```typescript\n * const csp = vanaConnectCsp(\"production\");\n * // { \"frame-src\": [\"https://account.vana.org\"],\n * //   \"connect-src\": [\"https://account.vana.org\"] }\n * const header = Object.entries(csp)\n *   .map(([directive, sources]) => `${directive} 'self' ${sources.join(\" \")}`)\n *   .join(\"; \");\n * ```\n *\n * @param target - `\"production\"`, `\"dev\"`, or `{ accountOrigin }` for a\n * custom Vana Account deployment.\n * @returns The directives to add, each with the sources it needs.\n */\nexport function vanaConnectCsp(\n  target: VanaConnectEnv | { accountOrigin: string },\n): { \"connect-src\": string[]; \"frame-src\": string[] } {\n  const origin =\n    target === \"production\" || target === \"dev\"\n      ? VANA_ACCOUNT_ORIGINS[target]\n      : typeof target === \"object\" &&\n          target !== null &&\n          typeof target.accountOrigin === \"string\"\n        ? normalizeOrigin(target.accountOrigin)\n        : null;\n  if (!origin) {\n    throw new TypeError(\n      'vanaConnectCsp needs \"production\", \"dev\" or an http(s) accountOrigin',\n    );\n  }\n  return { \"connect-src\": [origin], \"frame-src\": [origin] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqDO,MAAM,mBAAmB;AAGzB,MAAM,uBAAuB;AAM7B,MAAM,aAAa;AAUnB,MAAM,oBAAoB;AAG1B,MAAM,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AACX;AAUO,MAAM,mBAAmB,CAAC,SAAS,YAAY;AAM/C,MAAM,0BAA0C;AAQhD,SAAS,mBAAmB,OAAuC;AACxE,SAAO,iBAAiB,KAAK,CAAC,UAAU,UAAU,KAAK,KAAK;AAC9D;AAGO,MAAM,uBAAuB;AAAA,EAClC,YAAY;AAAA,EACZ,KAAK;AACP;AAcO,MAAM,sBAAsB,qBAAqB;AAaxD,MAAM,sBAAoD;AAAA,EACxD;AAAA,EACA;AACF;AASA,MAAM,kBAAmD;AAAA,EACvD;AAAA,EACA;AACF;AAGO,MAAM,sBAAsB;AAyFnC,MAAM,mBAA6C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,oBAA+C;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,cAAc;AACpB,MAAM,gBAAgB;AACtB,MAAM,aAAa;AACnB,MAAM,YAAY;AAElB,SAAS,OAAO,OAAgD;AAC9D,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD;AACN;AAEA,SAAS,mBAAmB,OAA0C;AACpE,SACE,OAAO,UAAU,YACjB,OAAO,UAAU,KAAK,KACtB,SAAS,wBACT,SAAS;AAEb;AAYO,SAAS,YAAY,OAAiC;AAC3D,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,kBAAkB,OAA6C;AACtE,QAAM,OAAO,OAAO,KAAK;AACzB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,EAAE,YAAY,WAAW,UAAU,IAAI;AAC7C,MACE,OAAO,eAAe,YACtB,CAAC,YAAY,KAAK,UAAU,KAC5B,OAAO,cAAc,YACrB,CAAC,cAAc,KAAK,SAAS,KAC7B,OAAO,cAAc,YACrB,CAAC,UAAU,KAAK,SAAS,GACzB;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAQO,SAAS,mBAAmB,OAAuC;AACxE,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,WAAW,CAAC,YAAY,QAAQ,EAAE,GAAG;AACxC,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,kBAAkB,QAAQ,aAAa;AAC7D,SAAO,gBAAgB,EAAE,eAAe,IAAI,QAAQ,GAAG,IAAI;AAC7D;AAcO,SAAS,wBAAwB,MAA8B;AACpE,QAAM,UAAU,OAAO,IAAI;AAC3B,MACE,CAAC,WACA,QAAQ,SAAS,gBAAgB,QAAQ,SAAS,cACnD;AACA,WAAO;AAAA,EACT;AACA,QAAM,EAAE,EAAE,IAAI;AACd,MAAI,OAAO,MAAM,YAAY,CAAC,OAAO,UAAU,CAAC,KAAK,mBAAmB,CAAC,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAaO,SAAS,kBAAkB,MAAoC;AACpE,QAAM,UAAU,OAAO,IAAI;AAC3B,MAAI,EAAE,WAAW,mBAAmB,QAAQ,CAAC,IAAI;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,IAAI,QAAQ;AAClB,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,MAAM,EAAE;AAAA,IACjC,KAAK,eAAe;AAClB,YAAM,EAAE,OAAO,IAAI;AACnB,UAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,GAAG;AAC1D,eAAO;AAAA,MACT;AACA,aAAO,EAAE,QAAQ,MAAM,eAAe,EAAE;AAAA,IAC1C;AAAA,IACA,KAAK,kBAAkB;AACrB,YAAM,aAAa,oBAAoB;AAAA,QACrC,CAAC,UAAU,UAAU,QAAQ;AAAA,MAC/B;AACA,aAAO,QAAQ,WAAW,cAAc,aACpC,EAAE,YAAY,QAAQ,YAAY,MAAM,kBAAkB,EAAE,IAC5D;AAAA,IACN;AAAA,IACA,KAAK,iBAAiB;AACpB,YAAM,QAAQ,gBAAgB,KAAK,CAAC,UAAU,UAAU,QAAQ,KAAK;AACrE,aAAO,QAAQ,EAAE,OAAO,MAAM,iBAAiB,EAAE,IAAI;AAAA,IACvD;AAAA,IACA,KAAK,cAAc;AACjB,UAAI,OAAO,QAAQ,SAAS,UAAU;AACpC,eAAO;AAAA,MACT;AACA,YAAM,OACJ,kBAAkB,KAAK,CAAC,UAAU,UAAU,QAAQ,IAAI,KACxD;AACF,aAAO,EAAE,MAAM,MAAM,cAAc,EAAE;AAAA,IACvC;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,oBAAoB,MAAsC;AACxE,QAAM,UAAU,OAAO,IAAI;AAC3B,MAAI,EAAE,WAAW,mBAAmB,QAAQ,CAAC,IAAI;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,IAAI,QAAQ;AAClB,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK,gBAAgB;AACnB,YAAM,UAAU,mBAAmB,QAAQ,OAAO;AAClD,aAAO,UAAU,EAAE,SAAS,MAAM,gBAAgB,EAAE,IAAI;AAAA,IAC1D;AAAA,IACA,KAAK,uBAAuB;AAC1B,YAAM,SAAS,iBAAiB,KAAK,CAAC,UAAU,UAAU,QAAQ,MAAM;AACxE,aAAO,SAAS,EAAE,QAAQ,MAAM,uBAAuB,EAAE,IAAI;AAAA,IAC/D;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,gBAAgB,OAA8B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS;AACzD,aAAO;AAAA,IACT;AACA,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,eAAe,OAIpB;AACT,QAAM,MAAM,IAAI,IAAI,mBAAmB,MAAM,UAAU;AACvD,MAAI,aAAa,IAAI,YAAY,UAAU,MAAM,QAAQ;AACzD,MAAI,aAAa,IAAI,YAAY,QAAQ,MAAM,aAAa;AAC5D,SAAO,IAAI,SAAS;AACtB;AAQO,SAAS,iBACd,MACgC;AAChC,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,QAAQ,OAAO,KAAK,eAAe,YACtC,EAAE,YAAY,KAAK,WAAW,IAC9B;AACN;AAUO,SAAS,SAAS,OAKd;AACT,QAAM,MAAM,IAAI,IAAI,YAAY,MAAM,UAAU;AAChD,MAAI,aAAa,IAAI,YAAY,UAAU,MAAM,QAAQ;AACzD,MAAI,aAAa,IAAI,YAAY,QAAQ,MAAM,aAAa;AAC5D,MAAI,aAAa,IAAI,YAAY,SAAS,OAAO,gBAAgB,CAAC;AAElE,MAAI,MAAM,WAAW,MAAM,YAAY,yBAAyB;AAC9D,QAAI,aAAa,IAAI,YAAY,SAAS,MAAM,OAAO;AAAA,EACzD;AACA,SAAO,IAAI,SAAS;AACtB;AA0BO,SAAS,eACd,QACoD;AACpD,QAAM,SACJ,WAAW,gBAAgB,WAAW,QAClC,qBAAqB,MAAM,IAC3B,OAAO,WAAW,YAChB,WAAW,QACX,OAAO,OAAO,kBAAkB,WAChC,gBAAgB,OAAO,aAAa,IACpC;AACR,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE;AAC1D;","names":[]}

package/dist/connect/protocol.d.ts

@@ -0,0 +1,331 @@
+/**
+ * Message protocol for the Vana connect sheet, shared by the partner-side
+ * launcher and the Vana-hosted sheet.
+ *
+ * @remarks
+ * Zero-dependency and browser-safe: it imports nothing, so a non-SDK
+ * consumer (Vana Account's sheet, a backend validating a request) can take
+ * it alone from `@opendatalabs/vana-sdk/connect/protocol`.
+ *
+ * ```
+ *   partner page                                   Vana sheet (iframe)
+ *   ────────────                                   ───────────────────
+ *   GET clientCheckUrl(...)             ───────▶   Vana's server: { registered }
+ *                                                  (alongside framing; false ends it
+ *                                                  with origin_not_registered)
+ *   iframe src = sheetUrl(...)          ───────▶   renders, bound to partner origin,
+ *                                                  laid out for its `display`
+ *                                       ◀───────   vana:ready
+ *                                       ◀───────   vana:resize { height }
+ *                                       ◀───────   vana:signed-in
+ *                                       ◀───────   vana:request-needed
+ *   vana:request { request }            ───────▶   loads the request via Vana's server
+ *                                       ◀───────   vana:connected { status, completion }
+ *                                                  (approved; data follows in the sheet)
+ *                                       ◀───────   vana:progress { phase }
+ *                                                  (remote_collect only; coarse, no source detail)
+ *   vana:request-status { status }      ───────▶   shows the partner-observed outcome
+ *                                       ◀───────   vana:close | vana:error { code }
+ * ```
+ *
+ * Every message carries `v`. Both sides post with an exact `targetOrigin` and
+ * check `event.origin` and `event.source` before parsing. Tokens never cross
+ * this boundary: the sheet only reports outcomes.
+ *
+ * The partner reads; it never writes. Approving a read request grants no
+ * write access, so there is no partner-to-sheet message that saves data.
+ *
+ * `vana:connected` means the person approved. It is not delivery: the data
+ * is ready only once the partner's backend reads it (the status poll and the
+ * read of the Direct flow say so).
+ *
+ * Versioning: the sheet URL carries the highest version the launcher speaks
+ * (`v`). Parsers accept any version from {@link MIN_PROTOCOL_VERSION} to
+ * {@link PROTOCOL_VERSION} and drop fields they do not know, so a sheet may
+ * add fields without a version bump. A `vana:ready` or `vana:error` at a
+ * version outside that range is reported as `incompatible_version` (see
+ * {@link readIncompatibleVersion}).
+ *
+ * @category Connect
+ * @module connect/protocol
+ */
+/** The protocol version this SDK posts and puts in the sheet URL. */
+export declare const PROTOCOL_VERSION = 1;
+/** The oldest protocol version this SDK still accepts from the other side. */
+export declare const MIN_PROTOCOL_VERSION = 1;
+/** A protocol version this SDK accepts. */
+export type ProtocolVersion = typeof PROTOCOL_VERSION;
+/** Path of the sheet page on the Vana Account origin. */
+export declare const SHEET_PATH = "/embed/connect";
+/**
+ * Says whether a (client id, partner origin) pair may frame the sheet.
+ *
+ * @remarks
+ * The browser refuses an unregistered frame silently, so the launcher asks
+ * here (without credentials) to name that failure instead of waiting out
+ * `frame_blocked`.
+ */
+export declare const CLIENT_CHECK_PATH = "/api/embed/connect/client";
+/** Query parameters the sheet reads. The origin is re-checked server side. */
+export declare const SHEET_QUERY: {
+    readonly clientId: "client_id";
+    readonly display: "display";
+    readonly origin: "origin";
+    readonly version: "v";
+};
+/**
+ * How the sheet is presented in the partner's window:
+ * `sheet`  a bottom sheet over the page, sized to its content;
+ * `fullscreen`  fills the whole window, for a window that holds nothing else,
+ *               such as a small popup the partner opened.
+ * It is presentation only: it authorizes nothing and the sheet's steps,
+ * messages and events are the same in both.
+ */
+export declare const CONNECT_DISPLAYS: readonly ["sheet", "fullscreen"];
+/** One of {@link CONNECT_DISPLAYS}. */
+export type ConnectDisplay = (typeof CONNECT_DISPLAYS)[number];
+/** The display `connect.open` uses when none is asked for. */
+export declare const DEFAULT_CONNECT_DISPLAY: ConnectDisplay;
+/**
+ * Read a display from untrusted input.
+ *
+ * @param value - Anything.
+ * @returns A known display, or `null` for anything else.
+ */
+export declare function readConnectDisplay(value: unknown): ConnectDisplay | null;
+/** Vana Account origin per deployment environment. */
+export declare const VANA_ACCOUNT_ORIGINS: {
+    readonly production: "https://account.vana.org";
+    readonly dev: "https://account-dev.vana.org";
+};
+/** Environment names {@link VANA_ACCOUNT_ORIGINS} is keyed by. */
+export type VanaConnectEnv = keyof typeof VANA_ACCOUNT_ORIGINS;
+/**
+ * The production Vana Account origin.
+ *
+ * @remarks
+ * Never used as an implicit default: the launcher, the flow and the CSP
+ * helper all need an explicit environment or origin, so a dev app cannot
+ * silently talk to production. Resolve the origin with
+ * `resolveVanaAccountOrigin` instead.
+ */
+export declare const DEFAULT_VANA_ORIGIN: "https://account.vana.org";
+/**
+ * How an approved request gets its data, always inside this sheet.
+ *
+ * @remarks
+ * `in_browser`: the person's Personal Server already holds every scope and
+ * serves them from the sheet until the partner reads.
+ * `remote_collect`: some scopes are missing, so the sheet collects them (a
+ * remote browser, driven with the person) and then serves.
+ */
+export type ConnectCompletion = "in_browser" | "remote_collect";
+/**
+ * Where a `remote_collect` request stands once approved. Deliberately coarse:
+ * it says nothing of which source, what was asked of the person, or how it is
+ * going. The partner shows "Vana is collecting your data", nothing more.
+ */
+export type ConnectProgressPhase = "collecting" | "writing";
+/** Height reports below this are a hidden or throttled frame, never content. */
+export declare const MIN_SHEET_HEIGHT_PX = 80;
+/** Direct Data Controller status vocabulary, as the partner backend sees it. */
+export type RequestStatus = "pending" | "approved" | "completed" | "denied" | "expired";
+/**
+ * A partner-signed, short-lived read capability for one request.
+ *
+ * @remarks
+ * The sheet asks for it (`vana:request-needed`) once the person has signed
+ * in, so the partner signs it fresh; it expires within minutes. It is the
+ * Direct SDK request signature for `GET /api/data-connection-requests/<id>`,
+ * minted by the partner's backend with its app key. Vana's server replays it
+ * to the request authority, so the sheet shows the request's real scopes and
+ * the partner cannot claim someone else's app.
+ */
+export interface RequestAuthorization {
+    appAddress: `0x${string}`;
+    signature: `0x${string}`;
+    timestamp: string;
+}
+/** What the partner hands the sheet: a request id and its read capability. */
+export interface ConnectRequest {
+    authorization: RequestAuthorization;
+    id: string;
+}
+/**
+ * Error codes the sheet reports.
+ *
+ * @remarks
+ * `frame_blocked`: no `vana:ready` in time, usually the page's own CSP.
+ * `incompatible_version`: the sheet speaks a protocol version this SDK does
+ * not (detected by the launcher).
+ * `origin_not_registered`: this page's origin is not registered for the
+ * client id.
+ * `vana_unavailable`: Vana itself is misconfigured or down here. Nothing the
+ * partner did, and nothing the partner can fix; the sheet stays open to say
+ * so.
+ * `sheet_failed`: the sheet could not finish this request.
+ */
+export type SheetErrorCode = "frame_blocked" | "incompatible_version" | "origin_not_registered" | "personal_server_unsupported" | "request_unavailable" | "sheet_failed" | "vana_unavailable";
+/** Sheet to partner. */
+export type SheetMessage = {
+    type: "vana:ready";
+    v: ProtocolVersion;
+} | {
+    height: number;
+    type: "vana:resize";
+    v: ProtocolVersion;
+} | {
+    type: "vana:signed-in";
+    v: ProtocolVersion;
+} | {
+    type: "vana:request-needed";
+    v: ProtocolVersion;
+} | {
+    completion: ConnectCompletion;
+    status: "approved";
+    type: "vana:connected";
+    v: ProtocolVersion;
+} | {
+    phase: ConnectProgressPhase;
+    type: "vana:progress";
+    v: ProtocolVersion;
+} | {
+    type: "vana:close";
+    v: ProtocolVersion;
+} | {
+    code: SheetErrorCode;
+    type: "vana:error";
+    v: ProtocolVersion;
+};
+/** Partner to sheet. */
+export type PartnerMessage = {
+    request: ConnectRequest;
+    type: "vana:request";
+    v: ProtocolVersion;
+} | {
+    status: RequestStatus;
+    type: "vana:request-status";
+    v: ProtocolVersion;
+};
+/**
+ * Whether a request id has the shape the sheet accepts.
+ *
+ * @remarks
+ * The id is signed into a request path, so anything outside this shape could
+ * name a different resource. Signers refuse it.
+ *
+ * @param value - The candidate request id.
+ * @returns `true` for 1 to 128 characters of `[A-Za-z0-9_-]`.
+ */
+export declare function isRequestId(value: unknown): value is string;
+/**
+ * Parse a {@link ConnectRequest}. Extra fields are dropped.
+ *
+ * @param value - Untrusted input.
+ * @returns The request, or `null` when malformed.
+ */
+export declare function readConnectRequest(value: unknown): ConnectRequest | null;
+/**
+ * Detect a sheet that speaks a protocol version this SDK does not.
+ *
+ * @remarks
+ * Only `vana:ready` and `vana:error` are read at any version: they are the
+ * handshake, so the launcher can tell "the sheet is up but incompatible" from
+ * "the sheet never started". Everything else at an unknown version is ignored.
+ *
+ * @param data - A message posted by the sheet.
+ * @returns The sheet's version when it is outside the supported range,
+ * otherwise `null`.
+ */
+export declare function readIncompatibleVersion(data: unknown): number | null;
+/**
+ * Parse a message the sheet posted.
+ *
+ * @remarks
+ * Unknown fields are dropped. Unknown message types are ignored. An error
+ * code this SDK does not know is read as `sheet_failed`, so a newer sheet's
+ * failure is never silently lost.
+ *
+ * @param data - Untrusted `MessageEvent.data`.
+ * @returns The message, or `null` for unknown or malformed data.
+ */
+export declare function parseSheetMessage(data: unknown): SheetMessage | null;
+/**
+ * Parse a message the partner posted.
+ *
+ * @param data - Untrusted `MessageEvent.data`.
+ * @returns The message, or `null` for unknown or malformed data.
+ */
+export declare function parsePartnerMessage(data: unknown): PartnerMessage | null;
+/**
+ * Normalize to a bare origin.
+ *
+ * @param value - A URL or origin.
+ * @returns `scheme://host[:port]` for http(s), or `null` for anything else.
+ */
+export declare function normalizeOrigin(value: string): string | null;
+/**
+ * Build the client-check URL the launcher asks before the sheet is ready.
+ *
+ * @param input - The registered client id, the partner page origin, and the
+ * Vana Account origin.
+ * @returns `<vanaOrigin>/api/embed/connect/client?client_id&origin`.
+ */
+export declare function clientCheckUrl(input: {
+    clientId: string;
+    partnerOrigin: string;
+    vanaOrigin: string;
+}): string;
+/**
+ * Parse the client-check response body.
+ *
+ * @param data - Untrusted JSON.
+ * @returns `{ registered }`, or `null` for anything else.
+ */
+export declare function parseClientCheck(data: unknown): {
+    registered: boolean;
+} | null;
+/**
+ * Build the sheet's iframe URL.
+ *
+ * @param input - The registered client id, the partner page origin, the Vana
+ * Account origin, and optionally the display.
+ * @returns `<vanaOrigin>/embed/connect?client_id&origin&v`, plus `display` when
+ * it is not the default.
+ */
+export declare function sheetUrl(input: {
+    clientId: string;
+    display?: ConnectDisplay;
+    partnerOrigin: string;
+    vanaOrigin: string;
+}): string;
+/**
+ * Content-Security-Policy sources a partner page needs for the sheet.
+ *
+ * @remarks
+ * The launcher is bundled into the partner's own code, so only the frame
+ * and the launcher's client check (a credential-less `fetch`) need
+ * allowing. Merge the result into your existing policy; if the page sets
+ * `child-src` but not `frame-src`, add the origin there instead. There is no
+ * default target, so a dev app never allows production by accident.
+ *
+ * @example
+ * ```typescript
+ * const csp = vanaConnectCsp("production");
+ * // { "frame-src": ["https://account.vana.org"],
+ * //   "connect-src": ["https://account.vana.org"] }
+ * const header = Object.entries(csp)
+ *   .map(([directive, sources]) => `${directive} 'self' ${sources.join(" ")}`)
+ *   .join("; ");
+ * ```
+ *
+ * @param target - `"production"`, `"dev"`, or `{ accountOrigin }` for a
+ * custom Vana Account deployment.
+ * @returns The directives to add, each with the sources it needs.
+ */
+export declare function vanaConnectCsp(target: VanaConnectEnv | {
+    accountOrigin: string;
+}): {
+    "connect-src": string[];
+    "frame-src": string[];
+};

package/dist/connect/protocol.js

@@ -0,0 +1,215 @@
+const PROTOCOL_VERSION = 1;
+const MIN_PROTOCOL_VERSION = 1;
+const SHEET_PATH = "/embed/connect";
+const CLIENT_CHECK_PATH = "/api/embed/connect/client";
+const SHEET_QUERY = {
+  clientId: "client_id",
+  display: "display",
+  origin: "origin",
+  version: "v"
+};
+const CONNECT_DISPLAYS = ["sheet", "fullscreen"];
+const DEFAULT_CONNECT_DISPLAY = "sheet";
+function readConnectDisplay(value) {
+  return CONNECT_DISPLAYS.find((known) => known === value) ?? null;
+}
+const VANA_ACCOUNT_ORIGINS = {
+  production: "https://account.vana.org",
+  dev: "https://account-dev.vana.org"
+};
+const DEFAULT_VANA_ORIGIN = VANA_ACCOUNT_ORIGINS.production;
+const CONNECT_COMPLETIONS = [
+  "in_browser",
+  "remote_collect"
+];
+const PROGRESS_PHASES = [
+  "collecting",
+  "writing"
+];
+const MIN_SHEET_HEIGHT_PX = 80;
+const REQUEST_STATUSES = [
+  "pending",
+  "approved",
+  "completed",
+  "denied",
+  "expired"
+];
+const SHEET_ERROR_CODES = [
+  "frame_blocked",
+  "incompatible_version",
+  "origin_not_registered",
+  "personal_server_unsupported",
+  "request_unavailable",
+  "sheet_failed",
+  "vana_unavailable"
+];
+const HEX_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+const HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;
+const REQUEST_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const TIMESTAMP = /^[0-9]{10,16}$/;
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function isSupportedVersion(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_PROTOCOL_VERSION && value <= PROTOCOL_VERSION;
+}
+function isRequestId(value) {
+  return typeof value === "string" && REQUEST_ID.test(value);
+}
+function readAuthorization(value) {
+  const auth = record(value);
+  if (!auth) {
+    return null;
+  }
+  const { appAddress, signature, timestamp } = auth;
+  if (typeof appAddress !== "string" || !HEX_ADDRESS.test(appAddress) || typeof signature !== "string" || !HEX_SIGNATURE.test(signature) || typeof timestamp !== "string" || !TIMESTAMP.test(timestamp)) {
+    return null;
+  }
+  return {
+    appAddress,
+    signature,
+    timestamp
+  };
+}
+function readConnectRequest(value) {
+  const request = record(value);
+  if (!request || !isRequestId(request.id)) {
+    return null;
+  }
+  const authorization = readAuthorization(request.authorization);
+  return authorization ? { authorization, id: request.id } : null;
+}
+function readIncompatibleVersion(data) {
+  const message = record(data);
+  if (!message || message.type !== "vana:ready" && message.type !== "vana:error") {
+    return null;
+  }
+  const { v } = message;
+  if (typeof v !== "number" || !Number.isInteger(v) || isSupportedVersion(v)) {
+    return null;
+  }
+  return v;
+}
+function parseSheetMessage(data) {
+  const message = record(data);
+  if (!(message && isSupportedVersion(message.v))) {
+    return null;
+  }
+  const v = message.v;
+  switch (message.type) {
+    case "vana:ready":
+    case "vana:signed-in":
+    case "vana:request-needed":
+    case "vana:close":
+      return { type: message.type, v };
+    case "vana:resize": {
+      const { height } = message;
+      if (typeof height !== "number" || !Number.isFinite(height)) {
+        return null;
+      }
+      return { height, type: "vana:resize", v };
+    }
+    case "vana:connected": {
+      const completion = CONNECT_COMPLETIONS.find(
+        (known) => known === message.completion
+      );
+      return message.status === "approved" && completion ? { completion, status: "approved", type: "vana:connected", v } : null;
+    }
+    case "vana:progress": {
+      const phase = PROGRESS_PHASES.find((known) => known === message.phase);
+      return phase ? { phase, type: "vana:progress", v } : null;
+    }
+    case "vana:error": {
+      if (typeof message.code !== "string") {
+        return null;
+      }
+      const code = SHEET_ERROR_CODES.find((known) => known === message.code) ?? "sheet_failed";
+      return { code, type: "vana:error", v };
+    }
+    default:
+      return null;
+  }
+}
+function parsePartnerMessage(data) {
+  const message = record(data);
+  if (!(message && isSupportedVersion(message.v))) {
+    return null;
+  }
+  const v = message.v;
+  switch (message.type) {
+    case "vana:request": {
+      const request = readConnectRequest(message.request);
+      return request ? { request, type: "vana:request", v } : null;
+    }
+    case "vana:request-status": {
+      const status = REQUEST_STATUSES.find((known) => known === message.status);
+      return status ? { status, type: "vana:request-status", v } : null;
+    }
+    default:
+      return null;
+  }
+}
+function normalizeOrigin(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function clientCheckUrl(input) {
+  const url = new URL(CLIENT_CHECK_PATH, input.vanaOrigin);
+  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);
+  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);
+  return url.toString();
+}
+function parseClientCheck(data) {
+  const body = record(data);
+  return body && typeof body.registered === "boolean" ? { registered: body.registered } : null;
+}
+function sheetUrl(input) {
+  const url = new URL(SHEET_PATH, input.vanaOrigin);
+  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);
+  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);
+  url.searchParams.set(SHEET_QUERY.version, String(PROTOCOL_VERSION));
+  if (input.display && input.display !== DEFAULT_CONNECT_DISPLAY) {
+    url.searchParams.set(SHEET_QUERY.display, input.display);
+  }
+  return url.toString();
+}
+function vanaConnectCsp(target) {
+  const origin = target === "production" || target === "dev" ? VANA_ACCOUNT_ORIGINS[target] : typeof target === "object" && target !== null && typeof target.accountOrigin === "string" ? normalizeOrigin(target.accountOrigin) : null;
+  if (!origin) {
+    throw new TypeError(
+      'vanaConnectCsp needs "production", "dev" or an http(s) accountOrigin'
+    );
+  }
+  return { "connect-src": [origin], "frame-src": [origin] };
+}
+export {
+  CLIENT_CHECK_PATH,
+  CONNECT_DISPLAYS,
+  DEFAULT_CONNECT_DISPLAY,
+  DEFAULT_VANA_ORIGIN,
+  MIN_PROTOCOL_VERSION,
+  MIN_SHEET_HEIGHT_PX,
+  PROTOCOL_VERSION,
+  SHEET_PATH,
+  SHEET_QUERY,
+  VANA_ACCOUNT_ORIGINS,
+  clientCheckUrl,
+  isRequestId,
+  normalizeOrigin,
+  parseClientCheck,
+  parsePartnerMessage,
+  parseSheetMessage,
+  readConnectDisplay,
+  readConnectRequest,
+  readIncompatibleVersion,
+  sheetUrl,
+  vanaConnectCsp
+};
+//# sourceMappingURL=protocol.js.map

package/dist/connect/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/connect/protocol.ts"],"sourcesContent":["/**\n * Message protocol for the Vana connect sheet, shared by the partner-side\n * launcher and the Vana-hosted sheet.\n *\n * @remarks\n * Zero-dependency and browser-safe: it imports nothing, so a non-SDK\n * consumer (Vana Account's sheet, a backend validating a request) can take\n * it alone from `@opendatalabs/vana-sdk/connect/protocol`.\n *\n * ```\n *   partner page                                   Vana sheet (iframe)\n *   ────────────                                   ───────────────────\n *   GET clientCheckUrl(...)             ───────▶   Vana's server: { registered }\n *                                                  (alongside framing; false ends it\n *                                                  with origin_not_registered)\n *   iframe src = sheetUrl(...)          ───────▶   renders, bound to partner origin,\n *                                                  laid out for its `display`\n *                                       ◀───────   vana:ready\n *                                       ◀───────   vana:resize { height }\n *                                       ◀───────   vana:signed-in\n *                                       ◀───────   vana:request-needed\n *   vana:request { request }            ───────▶   loads the request via Vana's server\n *                                       ◀───────   vana:connected { status, completion }\n *                                                  (approved; data follows in the sheet)\n *                                       ◀───────   vana:progress { phase }\n *                                                  (remote_collect only; coarse, no source detail)\n *   vana:request-status { status }      ───────▶   shows the partner-observed outcome\n *                                       ◀───────   vana:close | vana:error { code }\n * ```\n *\n * Every message carries `v`. Both sides post with an exact `targetOrigin` and\n * check `event.origin` and `event.source` before parsing. Tokens never cross\n * this boundary: the sheet only reports outcomes.\n *\n * The partner reads; it never writes. Approving a read request grants no\n * write access, so there is no partner-to-sheet message that saves data.\n *\n * `vana:connected` means the person approved. It is not delivery: the data\n * is ready only once the partner's backend reads it (the status poll and the\n * read of the Direct flow say so).\n *\n * Versioning: the sheet URL carries the highest version the launcher speaks\n * (`v`). Parsers accept any version from {@link MIN_PROTOCOL_VERSION} to\n * {@link PROTOCOL_VERSION} and drop fields they do not know, so a sheet may\n * add fields without a version bump. A `vana:ready` or `vana:error` at a\n * version outside that range is reported as `incompatible_version` (see\n * {@link readIncompatibleVersion}).\n *\n * @category Connect\n * @module connect/protocol\n */\n\n/** The protocol version this SDK posts and puts in the sheet URL. */\nexport const PROTOCOL_VERSION = 1;\n\n/** The oldest protocol version this SDK still accepts from the other side. */\nexport const MIN_PROTOCOL_VERSION = 1;\n\n/** A protocol version this SDK accepts. */\nexport type ProtocolVersion = typeof PROTOCOL_VERSION;\n\n/** Path of the sheet page on the Vana Account origin. */\nexport const SHEET_PATH = \"/embed/connect\";\n\n/**\n * Says whether a (client id, partner origin) pair may frame the sheet.\n *\n * @remarks\n * The browser refuses an unregistered frame silently, so the launcher asks\n * here (without credentials) to name that failure instead of waiting out\n * `frame_blocked`.\n */\nexport const CLIENT_CHECK_PATH = \"/api/embed/connect/client\";\n\n/** Query parameters the sheet reads. The origin is re-checked server side. */\nexport const SHEET_QUERY = {\n  clientId: \"client_id\",\n  display: \"display\",\n  origin: \"origin\",\n  version: \"v\",\n} as const;\n\n/**\n * How the sheet is presented in the partner's window:\n * `sheet`  a bottom sheet over the page, sized to its content;\n * `fullscreen`  fills the whole window, for a window that holds nothing else,\n *               such as a small popup the partner opened.\n * It is presentation only: it authorizes nothing and the sheet's steps,\n * messages and events are the same in both.\n */\nexport const CONNECT_DISPLAYS = [\"sheet\", \"fullscreen\"] as const;\n\n/** One of {@link CONNECT_DISPLAYS}. */\nexport type ConnectDisplay = (typeof CONNECT_DISPLAYS)[number];\n\n/** The display `connect.open` uses when none is asked for. */\nexport const DEFAULT_CONNECT_DISPLAY: ConnectDisplay = \"sheet\";\n\n/**\n * Read a display from untrusted input.\n *\n * @param value - Anything.\n * @returns A known display, or `null` for anything else.\n */\nexport function readConnectDisplay(value: unknown): ConnectDisplay | null {\n  return CONNECT_DISPLAYS.find((known) => known === value) ?? null;\n}\n\n/** Vana Account origin per deployment environment. */\nexport const VANA_ACCOUNT_ORIGINS = {\n  production: \"https://account.vana.org\",\n  dev: \"https://account-dev.vana.org\",\n} as const;\n\n/** Environment names {@link VANA_ACCOUNT_ORIGINS} is keyed by. */\nexport type VanaConnectEnv = keyof typeof VANA_ACCOUNT_ORIGINS;\n\n/**\n * The production Vana Account origin.\n *\n * @remarks\n * Never used as an implicit default: the launcher, the flow and the CSP\n * helper all need an explicit environment or origin, so a dev app cannot\n * silently talk to production. Resolve the origin with\n * `resolveVanaAccountOrigin` instead.\n */\nexport const DEFAULT_VANA_ORIGIN = VANA_ACCOUNT_ORIGINS.production;\n\n/**\n * How an approved request gets its data, always inside this sheet.\n *\n * @remarks\n * `in_browser`: the person's Personal Server already holds every scope and\n * serves them from the sheet until the partner reads.\n * `remote_collect`: some scopes are missing, so the sheet collects them (a\n * remote browser, driven with the person) and then serves.\n */\nexport type ConnectCompletion = \"in_browser\" | \"remote_collect\";\n\nconst CONNECT_COMPLETIONS: readonly ConnectCompletion[] = [\n  \"in_browser\",\n  \"remote_collect\",\n];\n\n/**\n * Where a `remote_collect` request stands once approved. Deliberately coarse:\n * it says nothing of which source, what was asked of the person, or how it is\n * going. The partner shows \"Vana is collecting your data\", nothing more.\n */\nexport type ConnectProgressPhase = \"collecting\" | \"writing\";\n\nconst PROGRESS_PHASES: readonly ConnectProgressPhase[] = [\n  \"collecting\",\n  \"writing\",\n];\n\n/** Height reports below this are a hidden or throttled frame, never content. */\nexport const MIN_SHEET_HEIGHT_PX = 80;\n\n/** Direct Data Controller status vocabulary, as the partner backend sees it. */\nexport type RequestStatus =\n  | \"pending\"\n  | \"approved\"\n  | \"completed\"\n  | \"denied\"\n  | \"expired\";\n\n/**\n * A partner-signed, short-lived read capability for one request.\n *\n * @remarks\n * The sheet asks for it (`vana:request-needed`) once the person has signed\n * in, so the partner signs it fresh; it expires within minutes. It is the\n * Direct SDK request signature for `GET /api/data-connection-requests/<id>`,\n * minted by the partner's backend with its app key. Vana's server replays it\n * to the request authority, so the sheet shows the request's real scopes and\n * the partner cannot claim someone else's app.\n */\nexport interface RequestAuthorization {\n  appAddress: `0x${string}`;\n  signature: `0x${string}`;\n  timestamp: string;\n}\n\n/** What the partner hands the sheet: a request id and its read capability. */\nexport interface ConnectRequest {\n  authorization: RequestAuthorization;\n  id: string;\n}\n\n/**\n * Error codes the sheet reports.\n *\n * @remarks\n * `frame_blocked`: no `vana:ready` in time, usually the page's own CSP.\n * `incompatible_version`: the sheet speaks a protocol version this SDK does\n * not (detected by the launcher).\n * `origin_not_registered`: this page's origin is not registered for the\n * client id.\n * `vana_unavailable`: Vana itself is misconfigured or down here. Nothing the\n * partner did, and nothing the partner can fix; the sheet stays open to say\n * so.\n * `sheet_failed`: the sheet could not finish this request.\n */\nexport type SheetErrorCode =\n  | \"frame_blocked\"\n  | \"incompatible_version\"\n  | \"origin_not_registered\"\n  | \"personal_server_unsupported\"\n  | \"request_unavailable\"\n  | \"sheet_failed\"\n  | \"vana_unavailable\";\n\n/** Sheet to partner. */\nexport type SheetMessage =\n  | { type: \"vana:ready\"; v: ProtocolVersion }\n  | { height: number; type: \"vana:resize\"; v: ProtocolVersion }\n  | { type: \"vana:signed-in\"; v: ProtocolVersion }\n  | { type: \"vana:request-needed\"; v: ProtocolVersion }\n  | {\n      completion: ConnectCompletion;\n      status: \"approved\";\n      type: \"vana:connected\";\n      v: ProtocolVersion;\n    }\n  | {\n      phase: ConnectProgressPhase;\n      type: \"vana:progress\";\n      v: ProtocolVersion;\n    }\n  | { type: \"vana:close\"; v: ProtocolVersion }\n  | { code: SheetErrorCode; type: \"vana:error\"; v: ProtocolVersion };\n\n/** Partner to sheet. */\nexport type PartnerMessage =\n  | {\n      request: ConnectRequest;\n      type: \"vana:request\";\n      v: ProtocolVersion;\n    }\n  | {\n      status: RequestStatus;\n      type: \"vana:request-status\";\n      v: ProtocolVersion;\n    };\n\nconst REQUEST_STATUSES: readonly RequestStatus[] = [\n  \"pending\",\n  \"approved\",\n  \"completed\",\n  \"denied\",\n  \"expired\",\n];\n\nconst SHEET_ERROR_CODES: readonly SheetErrorCode[] = [\n  \"frame_blocked\",\n  \"incompatible_version\",\n  \"origin_not_registered\",\n  \"personal_server_unsupported\",\n  \"request_unavailable\",\n  \"sheet_failed\",\n  \"vana_unavailable\",\n];\n\nconst HEX_ADDRESS = /^0x[0-9a-fA-F]{40}$/;\nconst HEX_SIGNATURE = /^0x[0-9a-fA-F]{130}$/;\nconst REQUEST_ID = /^[A-Za-z0-9_-]{1,128}$/;\nconst TIMESTAMP = /^[0-9]{10,16}$/;\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction isSupportedVersion(value: unknown): value is ProtocolVersion {\n  return (\n    typeof value === \"number\" &&\n    Number.isInteger(value) &&\n    value >= MIN_PROTOCOL_VERSION &&\n    value <= PROTOCOL_VERSION\n  );\n}\n\n/**\n * Whether a request id has the shape the sheet accepts.\n *\n * @remarks\n * The id is signed into a request path, so anything outside this shape could\n * name a different resource. Signers refuse it.\n *\n * @param value - The candidate request id.\n * @returns `true` for 1 to 128 characters of `[A-Za-z0-9_-]`.\n */\nexport function isRequestId(value: unknown): value is string {\n  return typeof value === \"string\" && REQUEST_ID.test(value);\n}\n\nfunction readAuthorization(value: unknown): RequestAuthorization | null {\n  const auth = record(value);\n  if (!auth) {\n    return null;\n  }\n  const { appAddress, signature, timestamp } = auth;\n  if (\n    typeof appAddress !== \"string\" ||\n    !HEX_ADDRESS.test(appAddress) ||\n    typeof signature !== \"string\" ||\n    !HEX_SIGNATURE.test(signature) ||\n    typeof timestamp !== \"string\" ||\n    !TIMESTAMP.test(timestamp)\n  ) {\n    return null;\n  }\n  return {\n    appAddress: appAddress as `0x${string}`,\n    signature: signature as `0x${string}`,\n    timestamp,\n  };\n}\n\n/**\n * Parse a {@link ConnectRequest}. Extra fields are dropped.\n *\n * @param value - Untrusted input.\n * @returns The request, or `null` when malformed.\n */\nexport function readConnectRequest(value: unknown): ConnectRequest | null {\n  const request = record(value);\n  if (!request || !isRequestId(request.id)) {\n    return null;\n  }\n  const authorization = readAuthorization(request.authorization);\n  return authorization ? { authorization, id: request.id } : null;\n}\n\n/**\n * Detect a sheet that speaks a protocol version this SDK does not.\n *\n * @remarks\n * Only `vana:ready` and `vana:error` are read at any version: they are the\n * handshake, so the launcher can tell \"the sheet is up but incompatible\" from\n * \"the sheet never started\". Everything else at an unknown version is ignored.\n *\n * @param data - A message posted by the sheet.\n * @returns The sheet's version when it is outside the supported range,\n * otherwise `null`.\n */\nexport function readIncompatibleVersion(data: unknown): number | null {\n  const message = record(data);\n  if (\n    !message ||\n    (message.type !== \"vana:ready\" && message.type !== \"vana:error\")\n  ) {\n    return null;\n  }\n  const { v } = message;\n  if (typeof v !== \"number\" || !Number.isInteger(v) || isSupportedVersion(v)) {\n    return null;\n  }\n  return v;\n}\n\n/**\n * Parse a message the sheet posted.\n *\n * @remarks\n * Unknown fields are dropped. Unknown message types are ignored. An error\n * code this SDK does not know is read as `sheet_failed`, so a newer sheet's\n * failure is never silently lost.\n *\n * @param data - Untrusted `MessageEvent.data`.\n * @returns The message, or `null` for unknown or malformed data.\n */\nexport function parseSheetMessage(data: unknown): SheetMessage | null {\n  const message = record(data);\n  if (!(message && isSupportedVersion(message.v))) {\n    return null;\n  }\n  const v = message.v;\n  switch (message.type) {\n    case \"vana:ready\":\n    case \"vana:signed-in\":\n    case \"vana:request-needed\":\n    case \"vana:close\":\n      return { type: message.type, v };\n    case \"vana:resize\": {\n      const { height } = message;\n      if (typeof height !== \"number\" || !Number.isFinite(height)) {\n        return null;\n      }\n      return { height, type: \"vana:resize\", v };\n    }\n    case \"vana:connected\": {\n      const completion = CONNECT_COMPLETIONS.find(\n        (known) => known === message.completion,\n      );\n      return message.status === \"approved\" && completion\n        ? { completion, status: \"approved\", type: \"vana:connected\", v }\n        : null;\n    }\n    case \"vana:progress\": {\n      const phase = PROGRESS_PHASES.find((known) => known === message.phase);\n      return phase ? { phase, type: \"vana:progress\", v } : null;\n    }\n    case \"vana:error\": {\n      if (typeof message.code !== \"string\") {\n        return null;\n      }\n      const code =\n        SHEET_ERROR_CODES.find((known) => known === message.code) ??\n        \"sheet_failed\";\n      return { code, type: \"vana:error\", v };\n    }\n    default:\n      return null;\n  }\n}\n\n/**\n * Parse a message the partner posted.\n *\n * @param data - Untrusted `MessageEvent.data`.\n * @returns The message, or `null` for unknown or malformed data.\n */\nexport function parsePartnerMessage(data: unknown): PartnerMessage | null {\n  const message = record(data);\n  if (!(message && isSupportedVersion(message.v))) {\n    return null;\n  }\n  const v = message.v;\n  switch (message.type) {\n    case \"vana:request\": {\n      const request = readConnectRequest(message.request);\n      return request ? { request, type: \"vana:request\", v } : null;\n    }\n    case \"vana:request-status\": {\n      const status = REQUEST_STATUSES.find((known) => known === message.status);\n      return status ? { status, type: \"vana:request-status\", v } : null;\n    }\n    default:\n      return null;\n  }\n}\n\n/**\n * Normalize to a bare origin.\n *\n * @param value - A URL or origin.\n * @returns `scheme://host[:port]` for http(s), or `null` for anything else.\n */\nexport function normalizeOrigin(value: string): string | null {\n  try {\n    const url = new URL(value);\n    if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n      return null;\n    }\n    return url.origin;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Build the client-check URL the launcher asks before the sheet is ready.\n *\n * @param input - The registered client id, the partner page origin, and the\n * Vana Account origin.\n * @returns `<vanaOrigin>/api/embed/connect/client?client_id&origin`.\n */\nexport function clientCheckUrl(input: {\n  clientId: string;\n  partnerOrigin: string;\n  vanaOrigin: string;\n}): string {\n  const url = new URL(CLIENT_CHECK_PATH, input.vanaOrigin);\n  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);\n  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);\n  return url.toString();\n}\n\n/**\n * Parse the client-check response body.\n *\n * @param data - Untrusted JSON.\n * @returns `{ registered }`, or `null` for anything else.\n */\nexport function parseClientCheck(\n  data: unknown,\n): { registered: boolean } | null {\n  const body = record(data);\n  return body && typeof body.registered === \"boolean\"\n    ? { registered: body.registered }\n    : null;\n}\n\n/**\n * Build the sheet's iframe URL.\n *\n * @param input - The registered client id, the partner page origin, the Vana\n * Account origin, and optionally the display.\n * @returns `<vanaOrigin>/embed/connect?client_id&origin&v`, plus `display` when\n * it is not the default.\n */\nexport function sheetUrl(input: {\n  clientId: string;\n  display?: ConnectDisplay;\n  partnerOrigin: string;\n  vanaOrigin: string;\n}): string {\n  const url = new URL(SHEET_PATH, input.vanaOrigin);\n  url.searchParams.set(SHEET_QUERY.clientId, input.clientId);\n  url.searchParams.set(SHEET_QUERY.origin, input.partnerOrigin);\n  url.searchParams.set(SHEET_QUERY.version, String(PROTOCOL_VERSION));\n  // The default is left out: a bottom sheet's URL is what it has always been.\n  if (input.display && input.display !== DEFAULT_CONNECT_DISPLAY) {\n    url.searchParams.set(SHEET_QUERY.display, input.display);\n  }\n  return url.toString();\n}\n\n/**\n * Content-Security-Policy sources a partner page needs for the sheet.\n *\n * @remarks\n * The launcher is bundled into the partner's own code, so only the frame\n * and the launcher's client check (a credential-less `fetch`) need\n * allowing. Merge the result into your existing policy; if the page sets\n * `child-src` but not `frame-src`, add the origin there instead. There is no\n * default target, so a dev app never allows production by accident.\n *\n * @example\n * ```typescript\n * const csp = vanaConnectCsp(\"production\");\n * // { \"frame-src\": [\"https://account.vana.org\"],\n * //   \"connect-src\": [\"https://account.vana.org\"] }\n * const header = Object.entries(csp)\n *   .map(([directive, sources]) => `${directive} 'self' ${sources.join(\" \")}`)\n *   .join(\"; \");\n * ```\n *\n * @param target - `\"production\"`, `\"dev\"`, or `{ accountOrigin }` for a\n * custom Vana Account deployment.\n * @returns The directives to add, each with the sources it needs.\n */\nexport function vanaConnectCsp(\n  target: VanaConnectEnv | { accountOrigin: string },\n): { \"connect-src\": string[]; \"frame-src\": string[] } {\n  const origin =\n    target === \"production\" || target === \"dev\"\n      ? VANA_ACCOUNT_ORIGINS[target]\n      : typeof target === \"object\" &&\n          target !== null &&\n          typeof target.accountOrigin === \"string\"\n        ? normalizeOrigin(target.accountOrigin)\n        : null;\n  if (!origin) {\n    throw new TypeError(\n      'vanaConnectCsp needs \"production\", \"dev\" or an http(s) accountOrigin',\n    );\n  }\n  return { \"connect-src\": [origin], \"frame-src\": [origin] };\n}\n"],"mappings":"AAqDO,MAAM,mBAAmB;AAGzB,MAAM,uBAAuB;AAM7B,MAAM,aAAa;AAUnB,MAAM,oBAAoB;AAG1B,MAAM,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AACX;AAUO,MAAM,mBAAmB,CAAC,SAAS,YAAY;AAM/C,MAAM,0BAA0C;AAQhD,SAAS,mBAAmB,OAAuC;AACxE,SAAO,iBAAiB,KAAK,CAAC,UAAU,UAAU,KAAK,KAAK;AAC9D;AAGO,MAAM,uBAAuB;AAAA,EAClC,YAAY;AAAA,EACZ,KAAK;AACP;AAcO,MAAM,sBAAsB,qBAAqB;AAaxD,MAAM,sBAAoD;AAAA,EACxD;AAAA,EACA;AACF;AASA,MAAM,kBAAmD;AAAA,EACvD;AAAA,EACA;AACF;AAGO,MAAM,sBAAsB;AAyFnC,MAAM,mBAA6C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,oBAA+C;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,cAAc;AACpB,MAAM,gBAAgB;AACtB,MAAM,aAAa;AACnB,MAAM,YAAY;AAElB,SAAS,OAAO,OAAgD;AAC9D,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD;AACN;AAEA,SAAS,mBAAmB,OAA0C;AACpE,SACE,OAAO,UAAU,YACjB,OAAO,UAAU,KAAK,KACtB,SAAS,wBACT,SAAS;AAEb;AAYO,SAAS,YAAY,OAAiC;AAC3D,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,kBAAkB,OAA6C;AACtE,QAAM,OAAO,OAAO,KAAK;AACzB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,EAAE,YAAY,WAAW,UAAU,IAAI;AAC7C,MACE,OAAO,eAAe,YACtB,CAAC,YAAY,KAAK,UAAU,KAC5B,OAAO,cAAc,YACrB,CAAC,cAAc,KAAK,SAAS,KAC7B,OAAO,cAAc,YACrB,CAAC,UAAU,KAAK,SAAS,GACzB;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAQO,SAAS,mBAAmB,OAAuC;AACxE,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,WAAW,CAAC,YAAY,QAAQ,EAAE,GAAG;AACxC,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,kBAAkB,QAAQ,aAAa;AAC7D,SAAO,gBAAgB,EAAE,eAAe,IAAI,QAAQ,GAAG,IAAI;AAC7D;AAcO,SAAS,wBAAwB,MAA8B;AACpE,QAAM,UAAU,OAAO,IAAI;AAC3B,MACE,CAAC,WACA,QAAQ,SAAS,gBAAgB,QAAQ,SAAS,cACnD;AACA,WAAO;AAAA,EACT;AACA,QAAM,EAAE,EAAE,IAAI;AACd,MAAI,OAAO,MAAM,YAAY,CAAC,OAAO,UAAU,CAAC,KAAK,mBAAmB,CAAC,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAaO,SAAS,kBAAkB,MAAoC;AACpE,QAAM,UAAU,OAAO,IAAI;AAC3B,MAAI,EAAE,WAAW,mBAAmB,QAAQ,CAAC,IAAI;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,IAAI,QAAQ;AAClB,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,MAAM,EAAE;AAAA,IACjC,KAAK,eAAe;AAClB,YAAM,EAAE,OAAO,IAAI;AACnB,UAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,GAAG;AAC1D,eAAO;AAAA,MACT;AACA,aAAO,EAAE,QAAQ,MAAM,eAAe,EAAE;AAAA,IAC1C;AAAA,IACA,KAAK,kBAAkB;AACrB,YAAM,aAAa,oBAAoB;AAAA,QACrC,CAAC,UAAU,UAAU,QAAQ;AAAA,MAC/B;AACA,aAAO,QAAQ,WAAW,cAAc,aACpC,EAAE,YAAY,QAAQ,YAAY,MAAM,kBAAkB,EAAE,IAC5D;AAAA,IACN;AAAA,IACA,KAAK,iBAAiB;AACpB,YAAM,QAAQ,gBAAgB,KAAK,CAAC,UAAU,UAAU,QAAQ,KAAK;AACrE,aAAO,QAAQ,EAAE,OAAO,MAAM,iBAAiB,EAAE,IAAI;AAAA,IACvD;AAAA,IACA,KAAK,cAAc;AACjB,UAAI,OAAO,QAAQ,SAAS,UAAU;AACpC,eAAO;AAAA,MACT;AACA,YAAM,OACJ,kBAAkB,KAAK,CAAC,UAAU,UAAU,QAAQ,IAAI,KACxD;AACF,aAAO,EAAE,MAAM,MAAM,cAAc,EAAE;AAAA,IACvC;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,oBAAoB,MAAsC;AACxE,QAAM,UAAU,OAAO,IAAI;AAC3B,MAAI,EAAE,WAAW,mBAAmB,QAAQ,CAAC,IAAI;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,IAAI,QAAQ;AAClB,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK,gBAAgB;AACnB,YAAM,UAAU,mBAAmB,QAAQ,OAAO;AAClD,aAAO,UAAU,EAAE,SAAS,MAAM,gBAAgB,EAAE,IAAI;AAAA,IAC1D;AAAA,IACA,KAAK,uBAAuB;AAC1B,YAAM,SAAS,iBAAiB,KAAK,CAAC,UAAU,UAAU,QAAQ,MAAM;AACxE,aAAO,SAAS,EAAE,QAAQ,MAAM,uBAAuB,EAAE,IAAI;AAAA,IAC/D;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAQO,SAAS,gBAAgB,OAA8B;AAC5D,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS;AACzD,aAAO;AAAA,IACT;AACA,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,eAAe,OAIpB;AACT,QAAM,MAAM,IAAI,IAAI,mBAAmB,MAAM,UAAU;AACvD,MAAI,aAAa,IAAI,YAAY,UAAU,MAAM,QAAQ;AACzD,MAAI,aAAa,IAAI,YAAY,QAAQ,MAAM,aAAa;AAC5D,SAAO,IAAI,SAAS;AACtB;AAQO,SAAS,iBACd,MACgC;AAChC,QAAM,OAAO,OAAO,IAAI;AACxB,SAAO,QAAQ,OAAO,KAAK,eAAe,YACtC,EAAE,YAAY,KAAK,WAAW,IAC9B;AACN;AAUO,SAAS,SAAS,OAKd;AACT,QAAM,MAAM,IAAI,IAAI,YAAY,MAAM,UAAU;AAChD,MAAI,aAAa,IAAI,YAAY,UAAU,MAAM,QAAQ;AACzD,MAAI,aAAa,IAAI,YAAY,QAAQ,MAAM,aAAa;AAC5D,MAAI,aAAa,IAAI,YAAY,SAAS,OAAO,gBAAgB,CAAC;AAElE,MAAI,MAAM,WAAW,MAAM,YAAY,yBAAyB;AAC9D,QAAI,aAAa,IAAI,YAAY,SAAS,MAAM,OAAO;AAAA,EACzD;AACA,SAAO,IAAI,SAAS;AACtB;AA0BO,SAAS,eACd,QACoD;AACpD,QAAM,SACJ,WAAW,gBAAgB,WAAW,QAClC,qBAAqB,MAAM,IAC3B,OAAO,WAAW,YAChB,WAAW,QACX,OAAO,OAAO,kBAAkB,WAChC,gBAAgB,OAAO,aAAa,IACpC;AACR,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE;AAC1D;","names":[]}

package/dist/connect/protocol.test.d.ts

@@ -0,0 +1 @@
+export {};